[dependabot]

Bumps github/codeql-action from 4.37.8 to 4.38.2.

Release notes

Sourced from github/codeql-action's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot review overview

🟡 Changes recommended

The surrounding comments incorrectly describe the actions as tag-pinned at v4.37.8.

Review effort: Balanced
Findings: 1

Open (1)

• Update comments to document the v4.38.2 SHA pin · New

What changed in this PR

Updates CodeQL scanning from v4.37.8 to v4.38.2 using its immutable commit SHA.

Changes:

• Updates both CodeQL initialization and analysis actions.

File	Description
.github/​workflows/​codeql.yml	Bumps both CodeQL action steps to v4.38.2.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[martintmk]

Posted by an AI agent

Human review required at 091aabe7ca567ff926ea4484ca9bfe73cb503282: .github/workflows/codeql.yml still says both steps are intentionally tag-pinned at v4.37.8, but they now use the immutable v4.38.2 commit 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2. Please update the stale rationale in both comment blocks. See the current-head finding. Several CI checks are also still running, so approval is withheld.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.0%. Comparing base (c9ba134) to head (b6c35ce).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #791   +/-   ##
=======================================
  Coverage   100.0%   100.0%           
=======================================
  Files         791      790    -1     
  Lines       92131    92156   +25     
=======================================
+ Hits        92131    92156   +25     

Flag	Coverage Δ
linux	100.0% <ø> (ø)
linux-arm	100.0% <ø> (ø)
scheduled	?
windows	100.0% <ø> (+<0.1%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[martintmk]

AI review preparation has started for #791 at head 091aabe7ca567ff926ea4484ca9bfe73cb503282.

The submitted GitHub review will contain the result.

[martintmk]

Posted by an AI agent

Reviewed the CodeQL workflow bump: github/codeql-action init and analyze move from v4.37.8 to commit 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 (v4.38.2; the tag resolves to that commit). I checked correctness, tests and CI coverage, and documentation consistency. Public API, API design, naming, performance, telemetry and resilience do not apply to this workflow-only change. Nothing was run locally; all CI checks at this head, including both CodeQL analyze jobs, passed.

The language matrix, build modes and categories are unchanged. One non-blocking item: the comments next to both steps still say they are intentionally tag-pinned to v4.37.8 — already raised in the open Copilot thread; worth updating so the SHA pin is not reverted later.

Verdict: approve with non-blocking comments.

[Copilot]

🟢 Approval recommended

Both action pins match the release commit in the PR metadata, and no unresolved issues remain.

No open issues 🎉

1 resolved since last review

• Update comments to document the v4.38.2 SHA pin

_{Review effort: Balanced}

[martintmk]

isn't this updated as part of anvil?

[Copilot]

🟢 Approval recommended

The scoped version bump updates both action references consistently, with no unresolved issues identified.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The action references and rationale are consistent with the documented policy and maintainer-confirmed immutability, with no unresolved issues.

No open issues 🎉

_{Review effort: Balanced}

[Sergey Galkin (sgalkin)]

martintmk This one isn't managed by Anvil. .anvil.lock tracks the generated anvil-pr* and anvil-scheduled* workflows, but not .github/workflows/codeql.yml or the root AGENTS.md.

This PR is a Dependabot update to the standalone CodeQL workflow, plus documentation of the existing immutable-release pinning policy. No Anvil-generated files or templates are changed.

[Copilot]

🟢 Approval recommended

Both action references are consistent with the documented policy and developer-confirmed release immutability, with no unresolved findings.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

Both action references and comments match the documented policy, and the developer confirms that the release is immutable.

No open issues 🎉

_{Review effort: Balanced}